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1. INTRODUCTION 

Images are an eloquent representation of information beyond languages. Globally, a large number of 
images are generated and disbursed in all walks of life, as in the field of education, E-commerce, engineering 
and scientific diagrams, geographical maps, health services, and so on. In most cases, these images are stored 
in public cloud servers (CS) for low-cost storage and distribution. When sensitive images like medical images 
are stored in CS, privacy and security are the major concerns [1] of the image owners. The standard practice is 
to use steganography or encryption [2]. For homomorphic operations, encryption is well suited, and hence, in 
this work, we adopt image encryption for the privacy and security of the images at the CS. 

Homomorphic encryption (HE) enables mathematical computations in the cipher domain to return the 
correct results on decryption [3]. Here, the computational unit itself cannot decode or access the true data. 
Thus, using HE, privacy-preserving image processing tasks can be outsourced to the cloud servers, which can 
handle the heavy computational load. Therefore, with homomorphic encryption, the image storage, processing, 
and selective distribution tasks are delegated to the low-cost yet powerful cloud servers while maintaining 
adequate privacy. 

Let the HE functions be represented by E (...). Then, the encryption of a plaintext x, which is a 
number, gives the corresponding ciphertext, another number c as, 


c= E(x) (1) 


let the matching decryption function be denoted by D (...). Then the plaintext is recovered by decrypting c as, 
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x = D(c)=D(E(x)) (2) 
since D (...) is the inverse of E (...), they get cancelled, and we have, 


D(E(x)) = x 
Letcl =E(x1)andc2 = E(«2).Then,c1+c2 = E(m1) + £(m2) (3) 


in homomorphic addition (HA), The encryption function E (...) is constructed such that, 
E (m1) + E(m2) = E (m1 + m2) (4) 


such E (...) is called Additive Homomorphic Encryption. Now, (ci+c2)=E(mi+mz2) and the decryption of 
(c1+c2)=D (E (mi+mz)) gives the sum, (7711+m2) in plaintext domain. Subtraction and multiplication are similar. 
In the case of matrix operations, the operands M; and M2 are matrices as, 


E(M1) @ E(M2) = E (M1 ¢ M2) (5) 


here, » stands for +(addition), -(subtraction), *(multiplication) and *(element-wise multiplication). 

The realization of (...) that satisfies (5) is the HE for matrices. Since images are represented by 
matrices, homomorphic encryption of matrices facilitates homomorphic image processing (HIP). Several well- 
known techniques are available for image encryption [4] that provides the required security and privacy. 
However, in this paper, we briefly review only those works which provide homomorphic encryption to 
facilitate image processing in the cipher domain. Dowlin et al. [5], have introduced homomorphic encryption 
for biomedical calculations. An imaginative “manual” has been presented that uses the simple encrypted 
arithmetic library (SEAL) developed by microsoft research for homomorphic computations. Extensive usage 
of SEAL for common arithmetic and statistical operations is demonstrated. Fu et al. [6], have used SEAL for 
the homomorphic encryption of images. The authors have applied HE for image resizing using bilinear and 
bicubic methods. Additionally, privacy-preserving image compression and decompression are carried out using 
HE. Scale-invariant feature transform (SIFT) operation is outsourced using homomorphic encryption while 
keeping its key features intact [7]. Sift features are useful for image searching and matching. Here, the image 
is split into two shares and delegated to two separate cloud servers for implementing the SIFT. Then they are 
combined back to get the final result. Thus the process is inherently complex and time-consuming. Dowlin et al. [8], 
have presented a technique to transform previously trained neural networks into CryptoNets, which operate on 
encrypted data. The data owner can send queries and get back the predicted responses, both in encrypted form. 
Thus, the CS that hosts the CryptoNet does not access any real information about the data. However, the 
proposed method uses HE based on noise vectors and dual moduli, which results in reduced throughput due to 
the increased computational overhead when images are used as data inputs. 

Shortell and Shokoufandeh [9], have designed a convolutional neural network (CNN) based classifier 
in the cipher domain using fully homomorphic encryption (FHE). Thus the classifier operation is outsourced 
to the homo-classifier housed in powerful CS. The homomorphic operations are carried out using fixed point 
formats to represent real numbers. Therefore the proposed scheme is computationally expensive for large-sized 
images. Jiang et al. [10], have proposed a method for the homomorphic evaluation of scale-invariant feature 
transform (SIFT) for encrypted images. It uses NTRU (“N-th degree truncated polynomial ring units”) to 
implement a full homomorphic encryption that can be scaled up easily. This scheme provides homomorphic 
image matching apart from SIFT coefficients. However, the SIFT calculations are not exact due to the 
inaccuracy in the homomorphic division. Basic image morphological operations like erosion, dilation, opening 
are implemented in the cipher domain using homomorphic multiplication in the finite field Z2 [11]. For HE, 
the authors use monoid algebra which is not fully immune to chosen plaintext and ciphertext attacks. 

Jiang and Yang [12], have implemented privacy-preserving block truncation coding (BTC) of images 
after image encryption based on block permutation, diffusion, and bit plane shuffling. The resulting encryption 
does not alter the BTC parameters, and hence the image compression process is implemented in the cipher 
domain based on BTC. However, BTC-based compression incurs heavy information loss and may not be 
suitable for general medical images. Vengadapurvaja et al. [13], have implemented HE using dual moduli 
symmetric encryption scheme using two large prime numbers. When applied to images, this method 
encrypts/decrypts data element by element. Therefore, for large-sized images, it is computationally costly. 
Li et al. [14], have used the elgamal method based on elliptic curve cryptography (ECC) to provide 
homomorphic addition of images. The main disadvantage of this method is that it cannot implement 
homomorphic multiplication, and thus, its applications are limited. Additionally, ECC inherently involves 
extensive computations and is not suitable for large-sized data, as in the case of images. Biometric images (iris, 
fingerprints, and faces) are encrypted for homomorphic image recognition and matching [15]. Here biometric 
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tokens are generated in the cipher domain for the purpose of matching. Therefore, this method is suitable for 
matching only and not for other image processing operations. 

Fully homomorphic encryption based on LWE has been developed in [16]-[18]. But the plaintext 
message space is a bit in [16], [17], and an integer vector in [18]. Therefore, plaintext matrices cannot be 
encrypted directly. Additionally, noise vectors are to be added during encryption which limits the flexibility of 
these encryptions. Chao ef al. [19], have used compact and resource-efficient CNN (CaRENets) for 
homomorphic inference on encrypted medical images. Vizitiu et al. [20], have used matrix operation for 
randomization or encryption (MORE) for secured data manipulation in the deep learning environment. 
However, in [19], [20], before encryption, the plaintext matrices must be packed column or row-wise, which 
leads to a higher computational cost. Dutil et al. [21], have used element-by-element encryption and then 
extended this to the whole matrix. This process consumes excessive time for encrypting large-sized matrices. 
Row and column shift operations must be carried out for homomorphic matrix encryption [22] which results 
in a higher computational cost. Zeriouh et al. [23], have adopted matrix exponentiation to generate the 
encryption matrix keys. matrix exponentiation is computationally very expensive for image matrices of large 
sizes. Additionally, the eigenvalues of the plaintext matrix can be derived from the cipher matrix, which is a 
significant security lapse. Kumar et al. [24], have used blockchain and homomorphic encryption to provide 
privacy while aggregating medical images. However, the ‘gradients encryption’ scheme employed here leads 
to a substantial computational cost when the image sizes are large. Jain et al. [25], have deployed Cheon-Kim- 
Kim-Song (CKKS) homomorphic scheme for secured image encryption while the images are being used in the 
deep learning scenarios. The major disadvantage of this method is the complexity involved in converting the 
integer vectors to the corresponding cyclotomic polynomials and vice versa. 

The main objective of this work is to mitigate the limitations of the existing HE techniques by 
developing an efficient matrix-based homomorphic encryption scheme for image processing, especially 
medical images. The proposed method is designated as matrix encryption for homomorphic image processing 
(MEHIP). 


2. THEORETICAL BASIS 
Special matrices whose elements are integers in finite field Zp are used in MEHIP for encryption and 
decryption. The decryption matrix key is designated by H. It is an integer matrix of size mxn in finite field Zp 
with m>n. Thus, H € Zp”*” and the elements of H are in the range 0 to p—1. Matrix H is generated such that, 
mod(H" *H, p) =Inxn (6) 
in (6), p is the modulus of the finite field Zp, and the scalar n depends on the size of the plain matrix to be 
encrypted. H7 is the Transpose of H and I,yn is the identity matrix of size nxn. The generation of H is given 


in (3.10.) 


2.1. Encryption key matrices 
Let us denote H7 by E as, 


E =H" 7) 
from (6) and (7), 

mod (E * H, p) = Inxn (8) 
when there is no ambiguity, (8) can be simply rewritten as, 


E* H = Inxn (9) 


here, the multiplication is modular in the finite field Zp, and the size of E is nxm. 


2.1.1. Left null space of H 
Since H is a tall matrix (m > n), it has the left null space [26]. Let matrix F be the modular left null 
space of H (Determination of F is given in 3.10.). Then, 


FeH= OGm—n)xn (10) 
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here, the size of F is (m—n) * m. On pre-multiplying both sides of (10) by an arbitrary random integer matrix 
Whrx(m-—n) that belongs to Zp, we have, 


Wrxcm-n) * (F * A) m—n)an = WrxGn-n) * OG@m=n)xn = Onn 
on deleting the dimension subscripts, we have, 

W*F*H=0 (11) 
let us denote the product W * F by R as, 

R=W#*F (12) 


2.1.2. Multiple versions of R 

In (12), W is an arbitrary random matrix in Zp. Hence, it can take different values as W {1}, W {2}...., 
W {i},..., and so on. Correspondingly, R also can take different values as, R {1} = W {1} * F, R {2} = W {2} * 
F,..., and so on as, 


R{j}=W{ij*F (13) 


for i=1, 2, ... and so on. R {i}’s are the multiple versions of R. In (13), the size of W {i} is nx(m-n), that of F 
is (m—n)xm, and that of R is nxm. From (13) and (10) for i=1, 2, ..., 


Ri 4h =050), (14) 


in (14), the size of R {i} is nxm, and that of H is mxn. 
Encryption matrices G {1}, G {2}, ..., @ {i} are derived from E as,G {1} =E+R {1}, G{2}=E+ 
R {2}, ..., and so on. That is, 


G {i} = E+ Rfi} (15) 


here, G{i} is the i" version of the encryption matrix. The size of G {i} is nxm. On post multiplying both sides 
of (15) by H, we have 


G{i}*H=E*H+Rf{i}*H (16) 
from (9), E * H = I1,,,., and from (10), R {i} * H = 0,,. Therefore, for i=1, 2, ..., 
a rae ee (17) 


multiple versions G {1}, G {2},..., are used for successive encryptions to prevent chosen plaintext attack (CPA) 
[27]. 


3. HOMOMORPHIC ENCRYPTION AND DESCRIPTION OF AN IMAGE MATRIX 

The homomorphic encryption of an image matrix generates an entirely different matrix whose pixel 
elements appear to be random. Therefore, the encrypted matrix does not reveal any information about the 
original image. The decryption process recovers the original image matrix. The homomonrphic encryption and 
decryption methods used in MEHIP are described in the following sections. 


3.1. Homomorphic encryption 
In MEHIP, an image matrix is homomorphically encrypted using G {i}’s and the H matrix as the secret 
keys. The double-sided encryption of the image matrix is carried out as, 


C = mod (CH «A *G {i},p) 
for convenient writing, the mod prefix and p are avoided, and C is expressed as, 
C=H*A*G {i} (18) 


In (18), the multiplication operations are carried out in Zp, using modular algebra. Further, in (18), A is the 
image matrix of size nxn. The elements of A belong to type uint8 (8-bit unsigned integer). The size of H is 
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mxn, and that of G {i} is nxm. Thus, the size of C is mxm. The version index i of G {i} can be any suitable 
value for which G {i} has already been calculated and kept ready. Cipher matrix C is sent to the CS for secured 
storage and consequent access by the authorized users. 


3.2. Decryption of C 
On receiving matrix C from the CS, the end-user decrypts it (using modular algebra) to get B as, 


B=H"*C*H (19) 
substituting for C from (18) gives, 
B=H'« H*A*G{i}*H (20) 


from (6), H? * H = I, and from (17), {i} * H = Iny». Using these two properties in (20) yields, B = A. Thus, 
the correctness of the decryption formula (19) is proved. 


3.3. Homomorphic addition of images 

In general, images are added to alter the contents of the images. The purpose of image addition could 
be to, 

— Insert some text, timestamp, or an icon. 

— Blura region of an image for privacy. 

— Modify the background or make image collages. 

— Overlay the contours or edges of an image on itself. 

With MEHIP, these operations can be carried out in the cipher domain with ensured privacy. Since 
matrix addition is used to add the respective images, the sizes of the images must be same for addition. 
Basically, it is pixel-wise addition. In MEHIP, the addition in the cipher domain takes place at the CS, and the 
cipher sum is accessed by the end user, who decrypts it to get the actual sum in the plaintext domain. 

Let A, and A, be two matrices to be added whose sizes are kxn. They are encrypted as, 
C, = A, *G {1} 
C, =A, *G on eu) 


in (21), the multiplication is in the finite field Zp. Cipher matricesC, and C, are sent to the CS. The CS adds 
(homomorphic addition) C, and C, (in finite field Zp) to get C3 as, 


aC ae (22) 
C; is sent to the end user, who owns the decryption key H, and C; is decrypted as, 
Bz =C3*H (23) 


3.3.1. Correctness of decryption 
From (21)-(23), 


Bz = (A, * G{1} + Az * G {2}) *H 
using the property G {i} * H = 1», matrix Bs is given by, 
Bz, =A,+ A, 


thus, addition in cipher domain (22) results in getting the correct result in the plaintext domain. The maximum 
value of an element, when two uint8 image matrices are added, can go up to 255+255=510. Hence, for the 
correct result of addition (addition in Zp should give the same result), the modulus of the finite field p has to 
be greater than 510. Hence the immediately succeeding prime number 521 is chosen for p. 


3.3.2. Homomorphic subtraction 

Homomorphic subtraction (HS) uses C3; = C,-C,. In this case, assuming that the result of the 
subtraction (A,- Az) is non-negative and within Zp, the resulting decrypted B3 would be correctly equal to 
(A,- Az). The HS can be used to recover one of the addends from the sum or to erase the target regions from 
an image. 


Indonesian J Elec Eng & Comp Sci, Vol. 31, No. 1, July 2023: 406-416 


Indonesian J Elec Eng & Comp Sci ISSN: 2502-4752 ) 411 
3.4. Homomorphic transpose with double side encryption 

Homomorphic transpose (HT) is the transpose operation on a matrix in the cipher domain. HT is used 
as an intermediate operand in many image processing algorithms. Consider the encryption of the plain matrix 
A of size nxn as, 

C=H*A*G {1} (24) 
let the transpose of C (cipher domain) be carried out at the CS as, 

CT = (H * A*G {1})" = G {1}" * A’ * HH" (25) 
decrypt C7 to get B as, 

BSH eG! a (26) 
from (25) and (26), 


B=H!' «(G {1}" * A’ +H" )*H =H" *G {(1}" * A’ +H" *¥H 
= (H" « G {1}") «A * (H” *H) (27) 


from (6), H? * H = Iny,, and from (17), G {i} * H = Inym, which, on taking the transpose, is the same as H7 « 
G {1}" = Inyn. Substitution of these relations in (27) results in, 


B=A™T (28) 
3.5. Homomorphic multiplication 


Homomorphic multiplication (HM) of plaintext square matrices A, and A, whose sizes are nxn, is 
carried out in Zp as follows. Initially, A, and A, are encrypted to get their cipher matrices C, and C, as, 


C, =H*A,*GQ} (29) 


C, = H* A, *G {2} (30) 
sizes of C, and C, are (mxm). Now, C, and C, are sent to the CS, which calculates the product C3 as, 


3.5.1. Decryption of C3 
Matrix C3, whose size is (mxm), is decrypted by the user as, 


B, =H" *C,*H (32) 
on substituting for C3 from (31) and further substituting for C,; and C, from (29) and (30), 

B, = H" * (H* A, *G{1}) * (H * A, *G {2}) *H (33) 
that is, 


B, =H' *«H*A,*G{1}*H*A2*G{2}*H 
= (H" « H) «A, * (G {1} * H) * A2 * (G {2} * H) 


from (6), H? * H = Inxn, from (17), G {1} * H = G {2} * H = Inyn. Therefore, in (33) reduces to, 
B, = A, * Ay (34) 


thus, homomorphic multiplication is achieved. All the above operations are carried out using modular 
arithmetic in Zp. 
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3.6. Discussion on homomorphic multiplication 

Consider the matrix product: Bz = A, * Az, which is obtained after decrypting the cipher product C3 
as in (32). Since encryption, multiplication, and decryption are carried out in Zp, the result B3 is also in Zp. 
That is, Bz = mod(A, * Az, p). Hence, if the maximum element of A, * A, is less than p, then mod (A, * 


Az,p) is equal to the exact numerical product A, * Ay. Thus, for the correct working of the homomorphic 
multiplication, the constraint to be satisfied is, 


p > max(A, * Az) (35) 


In the case of normal images, the max(A1) is 255 = 28-1 ~ 28. Therefore, the maximum individual 


product of 2 elements=2!°. Consider the product A, * A,, where the size of each matrix is nxn. Then, in matrix 
multiplication, each product element is formed by the summation of n individual product terms. Therefore, the 
maximum element of the product can go up to n * 21. Hence according to (35), for the correct result: 


p>n*«26 (36) 


Under this constraint, the computational complexity will be very large. Therefore, HM is not generally 
feasible for the product of two regular image matrices. However, HM is useful when one matrix is a binary 
matrix, and the other is a regular image matrix. Then, the product represents some elementary operations on 
the image matrix, like row swap, and column swap. Therefore, in these cases, the HM will provide privacy- 
preserving image processing. Homomorphic multiplication can be used for flipping a matrix up-down or left- 
right. 


3.7. Homomorphic flip up-down 


Let matrix FI represent the flipud Unx,). Then FY is an anti-diagonal matrix. An example with n=5 
appears as, 


0 
0 
Fisx5 =|0 
0 
1 


oOorRocCco 
> a) 
oo oro 
oooorFr 


the elementary operation F/ * A gives flipud (A) [28]. Homomorphic flip-up-down is realized using the HM as 
follows. Cipher matrices C, and C, are obtained as, 


C, =H* Fl*G{ (37) 


C, = H* A G{2} (38) 


the product C3 in the cipher domain is calculated as, 


Cz = C, * C, (39) 


the decryption of C3 is carried out as, 

B; =H’ *C3*H (40) 
after substituting for C3 from (39), we have, 

B, =H' «C1*C2*H 


further substitution for C; and C2 from (37) and (38) gives, 


B, =H’ « H* Fl*G{i}* H*Ax*xG{2}*H 


Indonesian J Elec Eng & Comp Sci, Vol. 31, No. 1, July 2023: 406-416 


Indonesian J Elec Eng & Comp Sci ISSN: 2502-4752 m) 413 


using the properties H? * H = I,,,,, and G {1} *H = G {2} * H = Inyn, we get By = FI * A, which is same 
as flipud (A), and thus, flip up-down is realized by the homomorphic multiplication. Similarly, it can be verified 
that Cz = C, * C, realizes the homomorphic flip left-right operation. 


3.8. Ciphertext expansion ratio 
Ciphertext expansion ratio, designated by CER is the ratio of the size of the cipher matrix to that of 
its plain matrix. A large CER means the size of the cipher matrix is large, so the communication and 
computational costs are relatively high. A lower CER indicates higher encryption efficiency. CER is expressed 
Size of Ciphermatrix in bits 
as, CER = —————_—__—__ 
Size of Plain matrix in bits 
is (p—1). Therefore, the number of bits required to represent an element of the cipher matrix is, ceil(log2(p—1)) 
bits. With p=521, the value of logo(p—1)=9.0224 and ceil(log2(p—1))=very nearly 9 bits. Now, for the plain text, 
the bit depth is 8 bits. Therefore, for the double side encryption, from (19), the size of the cipher matrix is 
mxm, and that of the plain matrix is nxn. Hence, 


. In MEHIP, the maximum possible value of an element of the cipher matrix 


CER = (m*m*9)/(n*n* 8) = (9/8) * (m/n)2 =1.125 * (m/n)2 ~ 1.125 


since m = n + 2, for large values of n, the value of m can be approximated by n. Then, CER=1.125. Thus, in 
MEHIP, this low constant value of CER is a major advantage. 


3.9. Security of MEHIP 

Some of the security aspects of MEHIP are discussed in this section. Brute force guessing of secret 
keys is almost impossible as each element of a secret key is a 9-bit integer in Zp. The probability of correct 
guessing it is 2° Additionally, the size of each key is mxn. Hence, the overall probability of correct guessing 
is 2°"""" which is extremely low. The security level can be increased further by taking m>(n+2) at the cost of 
increased cipher matrix size. In MEHIP, successive encryptions use randomized encryption keys, namely 
G {i}’s. Therefore, the knowledge of cipher matrices corresponding to the given plain matrices cannot reveal 
the encryption keys. Prevention of chosen ciphertext attack will be implemented in the next version of MEHIP. 


3.10. Generation of decryption and encryption key matrices E, F and H 
Initially, an orthogonal integer matrix Q is generated in Zp, by house holder construction [29] as, 


2eVeVT 
VI av 


Q = Imxm — (41) 


here, V is a non-zero column vector of size mx1. In the finite field Zp, division by the scalar (V7 * V) is 
replaced by multiplication by its modular inverse with respect to p. Therefore, in (41) is expressed as, (all 
calculations in modular algebra), 


Q = Imem — 2*V * VT * Modinv (V" *V,p) (42) 
here, the size of Q is mxm and it is orthogonal. Thus, 
Qr * Q =Imxm (43) 


now, matrix Q™ is partitioned row-wise into two sub-matrices, Ey im) Fom—n)xm and Q is partitioned column- 
wise into two sub-matrices, Hn and Hm x(m—n) a8 shown in (44), 


Enxm 
ae and Qmxm = [nse | axon | (44) 


Fom—n)xm 


Ons” rs 


now (43), QT * Q = Imm Can be rewritten in terms of the sub-matrices as, 


Inxn | Onx(m-n) 
* Lae | Hise | = os | a (45) 


OGm-—n)xn T(m—n)x(m—n 


Enxm 


Fom—n)xm 


from (45), it can be seen that, 
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Enxm * Amxn = Inxn = Ex iT (46) 
Fon—n)xm * Amen = OGm—n)xn =F*H (47) 


from the partition scheme of (44), it can be seen that E,ym = Hnxn- 


4. EXPERIMENTAL RESULTS AND DISCUSSION 
4.1. Homomorphic addition of a logo to an image 

In this example, the two images Aj, an axial view of an MRI and a logo image (character ‘A’) 
represented by A2, are added after HE. Figure | shows the original images and resulting images after HE and 
addition. Figures 1(a) and 1(c) show A; and A2 respectively. The corresponding encrypted images C; and C2 are 
shown in Figures 1(b) and 1(d). With HE, the encrypted images are highly random and do not leak any 
information about the original images. The result of addition, C3 in the cipher domain, is shown in Figure 1(e) 
and its decrypted version B3 is shown in Figure 1(f). 


(c) 


A [A | 


Encrypt | Encrypt | 


a Q 


(b) (d) (e) 


Figure 1. Homomorphic image addition show (a) Ai, (b) Ci, (c) Az, (d) C2, (e) C3, and (f) B3 


4.2. Performance analysis 

In MEHIP, homomorphic encryption and decryption are carried out in Zp using integer matrix keys. 
The execution time of encryption is discussed in this section. In MEHIP, the double-side homomorphic 
encryption involves two matrix multiplications as H * A * G {i}. The sizes of H, A, and G {i} are (mxn), (nxn), 
and (nxm), respectively. Therefore, the number of byte multiplications is (m*n*n+n*n*m). Since m = n+ 2, 
we can approximate m by n, and consequently, the number of byte multiplications would be (2 * n?). 

Therefore, the execution time for HE is of the order O (n?). Since the execution time is machine 
dependent, we compare the execution time (ET) of MEHIP with Brakerski and Vaikuntanathan (BV) [16] 
method and the modified gentry, sahai, waters (GSW) [17] method. These two methods also support 
homomorphic multiplication. Here, starting with an image of size 32x32, the size is progressively varied by 
increasing both the height and width by 32 each until the final size of 512x512 is reached. The square matrices 
are taken for easy calculation only. The execution times for encryption are experimentally determined for 
MEHIP, BV, and GSW methods. The result is shown in Figure 2. The BV method takes a slightly higher ET 
compared to MEHIP, as the former method must calculate the cipher text with two components. The modified 
GSW method takes relatively more time as the original GSW method uses messages in the form of bits, and 
additional manipulations and multiplications are required to handle integers, compared to MEHIP and BV 
methods. Since the MEHIP method directly operates on matrices, it uses the built-in matrix multiplication 
library so that the execution time is faster compared to the other two methods. 
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Figure 2. Comparison of execution times for homomorphic encryption of image matrices 


CONCLUSION 
A new method of homomorphic encryption based on integer matrix keys is developed for efficient 


image processing in the cipher domain. Apart from homomorphic addition and multiplication, the proposed 
method provides image flipping. The proposed method avoids the use of error vectors and re-linearization. 
Image addition, multiplication, flipping, and related operations are carried out in the cipher domain. It can take 
care of black and white, grayscale, and color images. Since the key size is relatively large (almost equal to that 
of the image to be encrypted, say 256x256 bytes for an image of the same size), it is immune to brute force 
attack. The adoption of randomized encryption for successive trials prevents chosen plaintext attacks. The 
ciphertext expansion ratio is slightly greater than one, which leads to lower communication overhead. The 
basic principle can be extended to high dynamic range images also. 
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